Phishing Email Analyzer Pro – Education Edition<\/title>\n <style>\n \/* Scoped Container for WordPress \/ Elementor \/ Gutenberg Compatibility *\/\n #pea-pro-container {\n --pea-bg: #090d16;\n --pea-card-bg: #111827;\n --pea-card-border: #1f2937;\n --pea-card-border-hover: #374151;\n --pea-text: #f9fafb;\n --pea-text-muted: #9ca3af;\n --pea-primary: #6366f1;\n --pea-primary-hover: #4f46e5;\n --pea-accent: #10b981;\n --pea-danger: #ef4444;\n --pea-warning: #f59e0b;\n --pea-radius: 14px;\n --pea-shadow: 0 10px 25px -5px rgba(0, 0, 0, 0.3), 0 8px 10px -6px rgba(0, 0, 0, 0.3);\n \n font-family: system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;\n background-color: var(--pea-bg);\n color: var(--pea-text);\n padding: 24px;\n border-radius: var(--pea-radius);\n box-sizing: border-box;\n width: 100%;\n max-width: 1400px;\n margin: 0 auto;\n position: relative;\n z-index: 1;\n transition: background 0.3s ease, color 0.3s ease;\n }\n\n #pea-pro-container.pea-light-mode {\n --pea-bg: #f8fafc;\n --pea-card-bg: #ffffff;\n --pea-card-border: #e2e8f0;\n --pea-card-border-hover: #cbd5e1;\n --pea-text: #0f172a;\n --pea-text-muted: #64748b;\n --pea-shadow: 0 10px 25px -5px rgba(0, 0, 0, 0.05), 0 8px 10px -6px rgba(0, 0, 0, 0.05);\n }\n\n #pea-pro-container * {\n box-sizing: border-box;\n }\n\n #pea-pro-container header {\n display: flex;\n justify-content: space-between;\n align-items: center;\n margin-bottom: 24px;\n border-bottom: 1px solid var(--pea-card-border);\n padding-bottom: 16px;\n flex-wrap: wrap;\n gap: 16px;\n }\n\n #pea-pro-container h1 {\n font-size: 1.75rem;\n font-weight: 800;\n margin: 0;\n color: var(--pea-text);\n display: flex;\n align-items: center;\n gap: 10px;\n }\n\n #pea-pro-container .pea-header-actions {\n display: flex;\n gap: 12px;\n align-items: center;\n flex-wrap: wrap;\n }\n\n #pea-pro-container .pea-theme-toggle {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n color: var(--pea-text);\n padding: 8px 16px;\n border-radius: 8px;\n cursor: pointer;\n font-size: 0.875rem;\n font-weight: 600;\n transition: all 0.2s;\n }\n\n #pea-pro-container .pea-theme-toggle:hover {\n border-color: var(--pea-card-border-hover);\n background: var(--pea-card-border);\n }\n\n \/* Input \/ Sample Section *\/\n #pea-pro-container .pea-input-section {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n border-radius: var(--pea-radius);\n padding: 24px;\n margin-bottom: 24px;\n box-shadow: var(--pea-shadow);\n }\n\n #pea-pro-container .pea-section-title {\n font-size: 1.1rem;\n font-weight: 700;\n margin-bottom: 12px;\n display: flex;\n justify-content: space-between;\n align-items: center;\n flex-wrap: wrap;\n gap: 12px;\n }\n\n #pea-pro-container textarea {\n width: 100%;\n height: 180px;\n background: var(--pea-bg);\n border: 1px solid var(--pea-card-border);\n color: var(--pea-text);\n padding: 14px;\n border-radius: 8px;\n font-family: monospace;\n font-size: 0.85rem;\n resize: vertical;\n outline: none;\n transition: border-color 0.2s;\n }\n\n #pea-pro-container textarea:focus {\n border-color: var(--pea-primary);\n }\n\n #pea-pro-container .pea-btn-group {\n display: flex;\n gap: 12px;\n margin-top: 16px;\n flex-wrap: wrap;\n justify-content: space-between;\n align-items: center;\n }\n\n #pea-pro-container .pea-btn {\n background: var(--pea-primary);\n color: white;\n border: none;\n padding: 10px 20px;\n border-radius: 8px;\n font-weight: 600;\n cursor: pointer;\n transition: background 0.2s, transform 0.1s;\n font-size: 0.875rem;\n display: inline-flex;\n align-items: center;\n gap: 8px;\n box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.1);\n }\n\n #pea-pro-container .pea-btn:hover {\n background: var(--pea-primary-hover);\n }\n\n #pea-pro-container .pea-btn:active {\n transform: scale(0.98);\n }\n\n #pea-pro-container .pea-btn-secondary {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n color: var(--pea-text);\n box-shadow: none;\n }\n\n #pea-pro-container .pea-btn-secondary:hover {\n background: var(--pea-card-border);\n border-color: var(--pea-card-border-hover);\n }\n\n #pea-pro-container .pea-samples-dropdown {\n display: flex;\n gap: 8px;\n align-items: center;\n }\n\n #pea-pro-container select {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n color: var(--pea-text);\n padding: 8px 14px;\n border-radius: 8px;\n cursor: pointer;\n font-size: 0.875rem;\n outline: none;\n }\n\n #pea-pro-container select:focus {\n border-color: var(--pea-primary);\n }\n\n \/* Dashboard Overview Grid *\/\n #pea-pro-container .pea-dashboard {\n display: grid;\n grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));\n gap: 16px;\n margin-bottom: 24px;\n }\n\n #pea-pro-container .pea-card {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n border-radius: var(--pea-radius);\n padding: 20px;\n box-shadow: var(--pea-shadow);\n }\n\n #pea-pro-container .pea-card-title {\n font-size: 0.813rem;\n color: var(--pea-text-muted);\n margin-bottom: 8px;\n text-transform: uppercase;\n letter-spacing: 0.05em;\n font-weight: 700;\n }\n\n #pea-pro-container .pea-card-value {\n font-size: 1.5rem;\n font-weight: 800;\n }\n\n \/* Analysis Sections \/ Tabs *\/\n #pea-pro-container .pea-tabs {\n display: flex;\n gap: 8px;\n margin-bottom: 16px;\n border-bottom: 1px solid var(--pea-card-border);\n padding-bottom: 12px;\n flex-wrap: wrap;\n }\n\n #pea-pro-container .pea-tab-btn {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n color: var(--pea-text-muted);\n padding: 8px 16px;\n border-radius: 8px;\n font-weight: 600;\n cursor: pointer;\n font-size: 0.875rem;\n transition: all 0.2s;\n }\n\n #pea-pro-container .pea-tab-btn.active {\n background: var(--pea-primary);\n color: white;\n border-color: var(--pea-primary);\n }\n\n #pea-pro-container .pea-tab-content {\n display: none;\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n border-radius: var(--pea-radius);\n padding: 24px;\n margin-bottom: 24px;\n box-shadow: var(--pea-shadow);\n }\n\n #pea-pro-container .pea-tab-content.active {\n display: block;\n }\n\n \/* Indicators Table & Lists *\/\n #pea-pro-container .pea-table-container {\n overflow-x: auto;\n margin-top: 12px;\n }\n\n #pea-pro-container table {\n width: 100%;\n border-collapse: collapse;\n text-align: left;\n font-size: 0.875rem;\n white-space: nowrap;\n }\n\n #pea-pro-container th, #pea-pro-container td {\n padding: 12px 16px;\n border-bottom: 1px solid var(--pea-card-border);\n }\n\n #pea-pro-container th {\n background: rgba(0, 0, 0, 0.15);\n font-weight: 700;\n color: var(--pea-text-muted);\n }\n\n #pea-pro-container tr:last-child td {\n border-bottom: none;\n }\n\n #pea-pro-container .pea-badge {\n display: inline-flex;\n align-items: center;\n gap: 6px;\n padding: 4px 10px;\n border-radius: 6px;\n font-size: 0.75rem;\n font-weight: 700;\n }\n\n #pea-pro-container .pea-badge-safe {\n background: rgba(16, 185, 129, 0.15);\n color: var(--pea-accent);\n }\n\n #pea-pro-container .pea-badge-low {\n background: rgba(59, 130, 246, 0.15);\n color: var(--pea-primary);\n }\n\n #pea-pro-container .pea-badge-warning {\n background: rgba(245, 158, 11, 0.15);\n color: var(--pea-warning);\n }\n\n #pea-pro-container .pea-badge-danger {\n background: rgba(239, 68, 68, 0.15);\n color: var(--pea-danger);\n }\n\n #pea-pro-container .pea-badge-critical {\n background: rgba(185, 28, 28, 0.25);\n color: #f87171;\n }\n\n \/* Educational Breakdown Cards *\/\n #pea-pro-container .pea-edu-grid {\n display: grid;\n grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));\n gap: 16px;\n margin-top: 16px;\n }\n\n #pea-pro-container .pea-edu-card {\n background: var(--pea-bg);\n border: 1px solid var(--pea-card-border);\n border-radius: 10px;\n padding: 16px;\n }\n\n #pea-pro-container .pea-edu-card h4 {\n margin-top: 0;\n margin-bottom: 8px;\n font-size: 1rem;\n color: var(--pea-primary);\n }\n\n #pea-pro-container .pea-edu-card p {\n margin: 0;\n font-size: 0.85rem;\n color: var(--pea-text-muted);\n line-height: 1.5;\n }\n\n #pea-pro-container .pea-hidden {\n display: none !important;\n }\n\n @media (max-width: 768px) {\n #pea-pro-container {\n padding: 12px;\n }\n #pea-pro-container header {\n flex-direction: column;\n align-items: stretch;\n }\n #pea-pro-container .pea-header-actions {\n justify-content: space-between;\n }\n #pea-pro-container .pea-btn-group {\n flex-direction: column;\n align-items: stretch;\n }\n }\n <\/style>\n<\/head>\n<body>\n\n <div id=\"pea-pro-container\">\n <header>\n <h1>\ud83c\udfa3 Phishing Email Analyzer Pro <span style=\"font-size: 0.85rem; background: rgba(99, 102, 241, 0.15); color: var(--pea-primary); padding: 4px 10px; border-radius: 6px; font-weight: 600;\">Education Edition<\/span><\/h1>\n <div class=\"pea-header-actions\">\n <button type=\"button\" class=\"pea-theme-toggle\" id=\"pea-theme-toggle\">\ud83c\udf13 Theme<\/button>\n <\/div>\n <\/header>\n\n \n <div class=\"pea-input-section\">\n <div class=\"pea-section-title\">\n <span>Paste Raw Email Source \/ Headers & Body<\/span>\n <div class=\"pea-samples-dropdown\">\n <select id=\"pea-sample-select\" title=\"Load Educational Sample\">\n <option value=\"\">— Load Sample Phish —<\/option>\n <option value=\"bank\">Sample 1: Fake Bank Urgent Password Reset<\/option>\n <option value=\"hr\">Sample 2: HR Payroll Update Scam<\/option>\n <option value=\"it\">Sample 3: IT Support Microsoft 365 Expiry<\/option>\n <\/select>\n <\/div>\n <\/div>\n <textarea id=\"pea-email-input\" placeholder=\"Paste full email raw text, headers (Return-Path, Received, Authentication-Results), and body here...\"><\/textarea>\n <div class=\"pea-btn-group\">\n <button type=\"button\" class=\"pea-btn\" id=\"pea-analyze-btn\">\ud83d\udd0d Run Phishing Analysis<\/button>\n <button type=\"button\" class=\"pea-btn pea-btn-secondary\" id=\"pea-clear-btn\">\ud83d\uddd1\ufe0f Clear<\/button>\n <\/div>\n <\/div>\n\n \n <div class=\"pea-dashboard pea-hidden\" id=\"pea-dashboard\">\n <div class=\"pea-card\">\n <div class=\"pea-card-title\">Threat Verdict<\/div>\n <div class=\"pea-card-value\" id=\"pea-stat-verdict\">–<\/div>\n <\/div>\n <div class=\"pea-card\">\n <div class=\"pea-card-title\">Risk Score<\/div>\n <div class=\"pea-card-value\" id=\"pea-stat-score\">0 \/ 100<\/div>\n <\/div>\n <div class=\"pea-card\">\n <div class=\"pea-card-title\">Suspicious URLs<\/div>\n <div class=\"pea-card-value\" id=\"pea-stat-urls\">0<\/div>\n <\/div>\n <div class=\"pea-card\">\n <div class=\"pea-card-title\">Anomalies Detected<\/div>\n <div class=\"pea-card-value\" id=\"pea-stat-anomalies\">0<\/div>\n <\/div>\n <\/div>\n\n \n <div id=\"pea-results-container\" class=\"pea-hidden\">\n <div class=\"pea-tabs\">\n <button type=\"button\" class=\"pea-tab-btn active\" data-tab=\"overview\">\ud83d\udcca Summary & Verdict<\/button>\n <button type=\"button\" class=\"pea-tab-btn\" data-tab=\"headers\">\ud83d\udcec Header Breakdown<\/button>\n <button type=\"button\" class=\"pea-tab-btn\" data-tab=\"urls\">\ud83d\udd17 Extracted URLs & Domains<\/button>\n <button type=\"button\" class=\"pea-tab-btn\" data-tab=\"indicators\">\ud83d\udea9 Threat Indicators<\/button>\n <button type=\"button\" class=\"pea-tab-btn\" data-tab=\"education\">\ud83c\udf93 Analyst Training Guide<\/button>\n <\/div>\n\n \n <div class=\"pea-tab-content active\" id=\"tab-overview\">\n <h3 style=\"margin-top:0;\">Investigation Summary<\/h3>\n <p id=\"pea-summary-text\" style=\"color: var(--pea-text-muted); line-height: 1.6;\"><\/p>\n <div style=\"margin-top: 20px;\">\n <h4 style=\"margin-bottom: 8px;\">Key Findings:<\/h4>\n <ul id=\"pea-findings-list\" style=\"margin: 0; padding-left: 20px; color: var(--pea-text-muted); line-height: 1.6;\"><\/ul>\n <\/div>\n <\/div>\n\n \n <div class=\"pea-tab-content\" id=\"tab-headers\">\n <h3 style=\"margin-top:0;\">Parsed Email Headers<\/h3>\n <div class=\"pea-table-container\">\n <table>\n <thead>\n <tr>\n <th>Header Field<\/th>\n <th>Extracted Value<\/th>\n <th>Security Implication<\/th>\n <\/tr>\n <\/thead>\n <tbody id=\"pea-headers-tbody\"><\/tbody>\n <\/table>\n <\/div>\n <\/div>\n\n \n <div class=\"pea-tab-content\" id=\"tab-urls\">\n <h3 style=\"margin-top:0;\">Discovered URLs & Links<\/h3>\n <p style=\"color: var(--pea-text-muted); font-size: 0.875rem;\">Links are automatically defanged (e.g., <code style=\"color:var(--pea-primary);\">http[s]:\/\/<\/code> and <code style=\"color:var(--pea-primary);\">[.]<\/code>) for safe educational handling.<\/p>\n <div class=\"pea-table-container\">\n <table>\n <thead>\n <tr>\n <th>Defanged URL<\/th>\n <th>Domain<\/th>\n <th>Risk Assessment<\/th>\n <\/tr>\n <\/thead>\n <tbody id=\"pea-urls-tbody\"><\/tbody>\n <\/table>\n <\/div>\n <\/div>\n\n \n <div class=\"pea-tab-content\" id=\"tab-indicators\">\n <h3 style=\"margin-top:0;\">Detected Threat Indicators (IOCs)<\/h3>\n <div class=\"pea-table-container\">\n <table>\n <thead>\n <tr>\n <th>Indicator Type<\/th>\n <th>Value<\/th>\n <th>Severity<\/th>\n <\/tr>\n <\/thead>\n <tbody id=\"pea-indicators-tbody\"><\/tbody>\n <\/table>\n <\/div>\n <\/div>\n\n \n <div class=\"pea-tab-content\" id=\"tab-education\">\n <h3 style=\"margin-top:0;\">Analyst Training & Educational Breakdown<\/h3>\n <p style=\"color: var(--pea-text-muted);\">Learn how security analysts dissect phishing emails manually and what techniques attackers use to deceive victims.<\/p>\n <div class=\"pea-edu-grid\">\n <div class=\"pea-edu-card\">\n <h4>1. Spoofed Sender Addresses<\/h4>\n <p>Attackers often display a trusted name in the <code style=\"color:var(--pea-primary);\">From<\/code> header while the actual underlying <code style=\"color:var(--pea-primary);\">Return-Path<\/code> or <code style=\"color:var(--pea-primary);\">Reply-To<\/code> points to an unrelated public or attacker-controlled domain.<\/p>\n <\/div>\n <div class=\"pea-edu-card\">\n <h4>2. Deceptive Hyperlinks<\/h4>\n <p>Phishing links frequently display friendly anchor text or official-looking domains while directing the user to completely different attacker-controlled landing pages designed for credential harvesting.<\/p>\n <\/div>\n <div class=\"pea-edu-card\">\n <h4>3. Artificial Urgency & Fear<\/h4>\n <p>Social engineering tactics rely on manufactured emergencies\u2014such as immediate account suspension, security breaches, or payroll errors\u2014to pressure victims into acting without verifying authenticity.<\/p>\n <\/div>\n <div class=\"pea-edu-card\">\n <h4>4. Authentication Failures<\/h4>\n <p>Examining SPF, DKIM, and DMARC results in email headers reveals whether the sending server was authorized by the domain owner to dispatch mail on their behalf.<\/p>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n\n <script>\n (function() {\n 'use strict';\n\n document.addEventListener('DOMContentLoaded', function() {\n const container = document.getElementById('pea-pro-container');\n if (!container) return;\n\n const themeToggleBtn = document.getElementById('pea-theme-toggle');\n const sampleSelect = document.getElementById('pea-sample-select');\n const emailInput = document.getElementById('pea-email-input');\n const analyzeBtn = document.getElementById('pea-analyze-btn');\n const clearBtn = document.getElementById('pea-clear-btn');\n\n const dashboard = document.getElementById('pea-dashboard');\n const resultsContainer = document.getElementById('pea-results-container');\n\n const statVerdict = document.getElementById('pea-stat-verdict');\n const statScore = document.getElementById('pea-stat-score');\n const statUrls = document.getElementById('pea-stat-urls');\n const statAnomalies = document.getElementById('pea-stat-anomalies');\n\n const summaryText = document.getElementById('pea-summary-text');\n const findingsList = document.getElementById('pea-findings-list');\n const headersTbody = document.getElementById('pea-headers-tbody');\n const urlsTbody = document.getElementById('pea-urls-tbody');\n const indicatorsTbody = document.getElementById('pea-indicators-tbody');\n\n \/\/ Educational Samples Database\n const samples = {\n bank: `Received: from mail.secure-bank-support-login.com (192.0.2.45) by mx.targetcorp.com with SMTP id x987; Mon, 02 Aug 2026 10:14:22 -0400\nFrom: \"Secure Banking Alert\" <support@secure-bank-support-login.com>\nReturn-Path: <bounces@evil-phishing-host.ru>\nReply-To: security@secure-bank-update-portal.net\nTo: employee@targetcorp.com\nSubject: URGENT: Your Online Banking Account Has Been Suspended!\nAuthentication-Results: spf=fail (sender IP is 192.0.2.45) dkim=none dmarc=fail\n\nDear Customer,\n\nWe detected unauthorized login attempts on your account. To prevent permanent closure, you must verify your identity immediately within 24 hours.\n\nPlease click the secure link below to restore access:\nhttps:\/\/secure-banking-login.com\/auth\/verify?id=99281\n\nSincerely,\nFraud Prevention Team`,\n hr: `Received: from mail.hr-payroll-update-portal.org (203.0.113.88) by mx.targetcorp.com with SMTP id h102; Mon, 02 Aug 2026 11:30:00 -0400\nFrom: \"HR Payroll Department\" <hr@hr-payroll-update-portal.org>\nReturn-Path: <admin@hr-payroll-update-portal.org>\nReply-To: hr-secure@free-mail-provider.com\nTo: employee@targetcorp.com\nSubject: ACTION REQUIRED: Updated Direct Deposit & Tax Forms for 2026\nAuthentication-Results: spf=pass dkim=neutral dmarc=neutral\n\nHello Staff,\n\nPlease review the attached updated tax withholding forms and confirm your direct deposit details before the upcoming payroll cutoff. \n\nAccess the portal here: http:\/\/payroll-update-portal-login.net\/signin?token=xyz123\n\nThank you,\nHuman Resources`,\n it: `Received: from mail.microsoft365-security-alerts.net (198.51.100.14) by mx.targetcorp.com with SMTP id i554; Mon, 02 Aug 2026 12:45:10 -0400\nFrom: \"Microsoft 365 Admin\" <admin@microsoft365-security-alerts.net>\nReturn-Path: <notification@microsoft365-security-alerts.net>\nReply-To: admin@microsoft365-security-alerts.net\nTo: employee@targetcorp.com\nSubject: Security Notice: Your M365 Password Expires Today\nAuthentication-Results: spf=fail dkim=fail dmarc=fail\n\nDear User,\n\nYour corporate mailbox password is set to expire in 2 hours. Failure to retain your current password will result in service termination.\n\nVerify your credentials at: https:\/\/login.microsoftonline.com.secure-update-portal.xyz\/auth\n\nRegards,\nIT Security Desk`\n };\n\n \/\/ Theme Toggle\n themeToggleBtn.addEventListener('click', function() {\n container.classList.toggle('pea-light-mode');\n });\n\n \/\/ Load Sample\n sampleSelect.addEventListener('change', function() {\n const val = this.value;\n if (samples[val]) {\n emailInput.value = samples[val];\n } else {\n emailInput.value = '';\n }\n });\n\n \/\/ Clear\n clearBtn.addEventListener('click', function() {\n emailInput.value = '';\n sampleSelect.value = '';\n dashboard.classList.add('pea-hidden');\n resultsContainer.classList.add('pea-hidden');\n });\n\n \/\/ Tabs Navigation\n const tabBtns = container.querySelectorAll('.pea-tab-btn');\n tabBtns.forEach(btn => {\n btn.addEventListener('click', function() {\n tabBtns.forEach(b => b.classList.remove('active'));\n container.querySelectorAll('.pea-tab-content').forEach(c => c.classList.remove('active'));\n \n this.classList.add('active');\n const targetId = 'tab-' + this.getAttribute('data-tab');\n const targetContent = document.getElementById(targetId);\n if (targetContent) {\n targetContent.classList.add('active');\n }\n });\n });\n\n \/\/ Robust Analysis Logic\n analyzeBtn.addEventListener('click', function() {\n const rawText = emailInput.value.trim();\n if (!rawText) {\n alert('Please paste email raw text or load a sample first.');\n return;\n }\n\n \/\/ Extract headers safely with robust fallbacks\n const fromMatch = rawText.match(\/^From:\\s*(.*)$\/im);\n const returnPathMatch = rawText.match(\/^Return-Path:\\s*(.*)$\/im);\n const replyToMatch = rawText.match(\/^Reply-To:\\s*(.*)$\/im);\n const subjectMatch = rawText.match(\/^Subject:\\s*(.*)$\/im);\n const authMatch = rawText.match(\/^Authentication-Results:\\s*(.*)$\/im);\n const receivedMatch = rawText.match(\/^Received:\\s*(.*)$\/im);\n\n const fromHeader = fromMatch && fromMatch[1] ? fromMatch[1].trim() : 'Not Found';\n const returnPath = returnPathMatch && returnPathMatch[1] ? returnPathMatch[1].trim() : 'Not Found';\n const replyTo = replyToMatch && replyToMatch[1] ? replyToMatch[1].trim() : 'None';\n const subject = subjectMatch && subjectMatch[1] ? subjectMatch[1].trim() : 'No Subject';\n const authResults = authMatch && authMatch[1] ? authMatch[1].trim() : 'Not Specified';\n const receivedHeader = receivedMatch && receivedMatch[1] ? receivedMatch[1].trim() : 'Unknown';\n\n \/\/ Extract URLs\n const urlRegex = \/https?:\\\/\\\/[^\\s]+\/g;\n const rawUrls = rawText.match(urlRegex) || [];\n const uniqueUrls = [...new Set(rawUrls)];\n\n \/\/ Heuristic Evaluation & Risk Scoring\n let riskScore = 10;\n let anomalies = [];\n let findings = [];\n\n \/\/ Authentication Checks\n const lowerAuth = authResults.toLowerCase();\n if (lowerAuth.includes('fail') || lowerAuth.includes('none')) {\n riskScore += 30;\n anomalies.push('Email authentication (SPF\/DKIM\/DMARC) failure or absence detected.');\n findings.push('Sender domain failed cryptographic verification checks (SPF\/DKIM\/DMARC).');\n } else if (lowerAuth.includes('pass')) {\n riskScore -= 5;\n }\n\n \/\/ Domain Mismatch Check\n const extractDomain = str => {\n const m = str.match(\/@([a-zA-Z0-9.-]+)\/);\n return m ? m[1].toLowerCase() : '';\n };\n const fromDom = extractDomain(fromHeader);\n const returnDom = extractDomain(returnPath);\n if (fromDom && returnDom && fromDom !== returnDom) {\n riskScore += 25;\n anomalies.push('Domain mismatch between From address and Return-Path.');\n findings.push(`From domain (${escapeHtml(fromDom)}) differs from Return-Path domain (${escapeHtml(returnDom)}), indicating potential spoofing.`);\n }\n\n \/\/ Reply-To Anomaly\n if (replyTo !== 'None' && !replyTo.toLowerCase().includes(fromDom)) {\n riskScore += 15;\n anomalies.push('Distinct Reply-To address detected pointing to an external domain.');\n findings.push(`Replies are redirected to a separate address: ${escapeHtml(replyTo)}`);\n }\n\n \/\/ Keyword Heuristics\n const lowerText = rawText.toLowerCase();\n const phishingKeywords = ['urgent', 'suspended', 'verify', 'password', 'expire', 'payroll', 'login', 'immediate', 'action required'];\n let keywordHits = phishingKeywords.filter(kw => lowerText.includes(kw));\n if (keywordHits.length >= 2) {\n riskScore += 20;\n anomalies.push(`High urgency social engineering trigger words detected (${keywordHits.join(', ')}).`);\n findings.push('Message uses coercive or urgent language to pressure recipients into immediate action.');\n }\n\n \/\/ Clamp risk score between 0 and 100\n if (riskScore < 0) riskScore = 0;\n if (riskScore > 100) riskScore = 100;\n\n \/\/ Threat Verdict Mapping\n let verdict = 'Safe';\n let verdictClass = 'pea-badge-safe';\n if (riskScore >= 20 && riskScore < 45) {\n verdict = 'Low Risk';\n verdictClass = 'pea-badge-low';\n } else if (riskScore >= 45 && riskScore < 75) {\n verdict = 'Medium Risk';\n verdictClass = 'pea-badge-warning';\n } else if (riskScore >= 75 && riskScore < 90) {\n verdict = 'High Risk';\n verdictClass = 'pea-badge-danger';\n } else if (riskScore >= 90) {\n verdict = 'Critical';\n verdictClass = 'pea-badge-critical';\n }\n\n \/\/ Populate Dashboard Metrics\n statVerdict.innerHTML = `<span class=\"pea-badge ${verdictClass}\">${verdict}<\/span>`;\n statScore.textContent = riskScore + ' \/ 100';\n statUrls.textContent = uniqueUrls.length;\n statAnomalies.textContent = anomalies.length;\n\n dashboard.classList.remove('pea-hidden');\n resultsContainer.classList.remove('pea-hidden');\n\n \/\/ Populate Overview Tab\n summaryText.textContent = `The analysis engine evaluated email headers, structural components, and textual heuristics. A calculated risk score of ${riskScore}\/100 was assigned, resulting in a verdict of ${verdict}. ${anomalies.length} security anomaly\/anomalies were successfully flagged.`;\n \n findingsList.innerHTML = '';\n if (findings.length === 0) {\n findingsList.innerHTML = '<li>No major anomalies detected. The message structure appears normal.<\/li>';\n } else {\n findings.forEach(f => {\n const li = document.createElement('li');\n li.textContent = f;\n findingsList.appendChild(li);\n });\n }\n\n \/\/ Populate Headers Table\n headersTbody.innerHTML = `\n <tr><td><strong>From<\/strong><\/td><td><code>${escapeHtml(fromHeader)}<\/code><\/td><td>Identifies the displayed sender persona.<\/td><\/tr>\n <tr><td><strong>Return-Path<\/strong><\/td><td><code>${escapeHtml(returnPath)}<\/code><\/td><td>Destination address for bounces and mail delivery reports.<\/td><\/tr>\n <tr><td><strong>Reply-To<\/strong><\/td><td><code>${escapeHtml(replyTo)}<\/code><\/td><td>Designated recipient address when replying.<\/td><\/tr>\n <tr><td><strong>Subject<\/strong><\/td><td><code>${escapeHtml(subject)}<\/code><\/td><td>Email subject line text.<\/td><\/tr>\n <tr><td><strong>Authentication<\/strong><\/td><td><code>${escapeHtml(authResults)}<\/code><\/td><td>SPF\/DKIM\/DMARC server validation status.<\/td><\/tr>\n <tr><td><strong>Originating Hop<\/strong><\/td><td><code>${escapeHtml(receivedHeader.substring(0, 60))}...<\/code><\/td><td>Initial receiving mail server network trace.<\/td><\/tr>\n `;\n\n \/\/ Populate URLs Table\n urlsTbody.innerHTML = '';\n if (uniqueUrls.length === 0) {\n urlsTbody.innerHTML = '<tr><td colspan=\"3\" style=\"text-align:center; color:var(--pea-text-muted);\">No URLs found in the text.<\/td><\/tr>';\n } else {\n uniqueUrls.forEach(url => {\n const defanged = defangUrl(url);\n const domain = extractDomainFromUrl(url);\n const isSuspicious = url.includes('login') || url.includes('auth') || url.includes('verify') || url.includes('xyz') || url.includes('net') || url.includes('support');\n const badge = isSuspicious ? '<span class=\"pea-badge pea-badge-warning\">Suspicious Pattern<\/span>' : '<span class=\"pea-badge pea-badge-safe\">Standard Link<\/span>';\n \n urlsTbody.innerHTML += `\n <tr>\n <td><code style=\"font-size:0.75rem;\">${escapeHtml(defanged)}<\/code><\/td>\n <td><code>${escapeHtml(domain)}<\/code><\/td>\n <td>${badge}<\/td>\n <\/tr>\n `;\n });\n }\n\n \/\/ Populate Indicators Table\n indicatorsTbody.innerHTML = '';\n if (anomalies.length === 0) {\n indicatorsTbody.innerHTML = '<tr><td colspan=\"3\" style=\"text-align:center; color:var(--pea-text-muted);\">No threat indicators triggered.<\/td><\/tr>';\n } else {\n anomalies.forEach(ano => {\n indicatorsTbody.innerHTML += `\n <tr>\n <td><span class=\"pea-badge pea-badge-warning\">Anomaly<\/span><\/td>\n <td>${escapeHtml(ano)}<\/td>\n <td><span class=\"pea-badge pea-badge-danger\">High Severity<\/span><\/td>\n <\/tr>\n `;\n });\n }\n });\n\n \/\/ Helper Functions\n function defangUrl(url) {\n return url\n .replace(\/https?:\\\/\\\/\/g, 'hxxps:\/\/')\n .replace(\/\\.\/g, '[.]');\n }\n\n function extractDomainFromUrl(url) {\n try {\n const parsed = new URL(url);\n return parsed.hostname;\n } catch (e) {\n return 'Invalid URL';\n }\n }\n\n function escapeHtml(str) {\n return String(str)\n .replace(\/&\/g, \"&\")\n .replace(\/<\/g, \"<\")\n .replace(\/>\/g, \">\")\n .replace(\/\"\/g, \""\")\n .replace(\/'\/g, \"'\");\n }\n });\n })();\n <\/script>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>Phishing Email Analyzer Pro – Education Edition \ud83c\udfa3 Phishing Email Analyzer Pro Education Edition \ud83c\udf13 Theme Paste Raw Email Source \/ Headers & Body — Load Sample Phish —Sample 1: Fake Bank Urgent Password ResetSample 2: HR Payroll Update ScamSample 3: IT Support Microsoft 365 Expiry \ud83d\udd0d Run Phishing Analysis \ud83d\uddd1\ufe0f Clear Threat Verdict – […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-871","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/pages\/871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/comments?post=871"}],"version-history":[{"count":2,"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/pages\/871\/revisions"}],"predecessor-version":[{"id":873,"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/pages\/871\/revisions\/873"}],"wp:attachment":[{"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/media?parent=871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":871,"date":"2026-08-02T13:02:23","date_gmt":"2026-08-02T13:02:23","guid":{"rendered":"https:\/\/freewebtools.co.in\/?page_id=871"},"modified":"2026-08-02T13:05:47","modified_gmt":"2026-08-02T13:05:47","slug":"phising-email-analyzer","status":"publish","type":"page","link":"https:\/\/freewebtools.co.in\/index.php\/phising-email-analyzer\/","title":{"rendered":"Phising Email Analyzer"},"content":{"rendered":"\n\n\n\n \n \n Phishing Email Analyzer Pro – Education Edition<\/title>\n <style>\n \/* Scoped Container for WordPress \/ Elementor \/ Gutenberg Compatibility *\/\n #pea-pro-container {\n --pea-bg: #090d16;\n --pea-card-bg: #111827;\n --pea-card-border: #1f2937;\n --pea-card-border-hover: #374151;\n --pea-text: #f9fafb;\n --pea-text-muted: #9ca3af;\n --pea-primary: #6366f1;\n --pea-primary-hover: #4f46e5;\n --pea-accent: #10b981;\n --pea-danger: #ef4444;\n --pea-warning: #f59e0b;\n --pea-radius: 14px;\n --pea-shadow: 0 10px 25px -5px rgba(0, 0, 0, 0.3), 0 8px 10px -6px rgba(0, 0, 0, 0.3);\n \n font-family: system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;\n background-color: var(--pea-bg);\n color: var(--pea-text);\n padding: 24px;\n border-radius: var(--pea-radius);\n box-sizing: border-box;\n width: 100%;\n max-width: 1400px;\n margin: 0 auto;\n position: relative;\n z-index: 1;\n transition: background 0.3s ease, color 0.3s ease;\n }\n\n #pea-pro-container.pea-light-mode {\n --pea-bg: #f8fafc;\n --pea-card-bg: #ffffff;\n --pea-card-border: #e2e8f0;\n --pea-card-border-hover: #cbd5e1;\n --pea-text: #0f172a;\n --pea-text-muted: #64748b;\n --pea-shadow: 0 10px 25px -5px rgba(0, 0, 0, 0.05), 0 8px 10px -6px rgba(0, 0, 0, 0.05);\n }\n\n #pea-pro-container * {\n box-sizing: border-box;\n }\n\n #pea-pro-container header {\n display: flex;\n justify-content: space-between;\n align-items: center;\n margin-bottom: 24px;\n border-bottom: 1px solid var(--pea-card-border);\n padding-bottom: 16px;\n flex-wrap: wrap;\n gap: 16px;\n }\n\n #pea-pro-container h1 {\n font-size: 1.75rem;\n font-weight: 800;\n margin: 0;\n color: var(--pea-text);\n display: flex;\n align-items: center;\n gap: 10px;\n }\n\n #pea-pro-container .pea-header-actions {\n display: flex;\n gap: 12px;\n align-items: center;\n flex-wrap: wrap;\n }\n\n #pea-pro-container .pea-theme-toggle {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n color: var(--pea-text);\n padding: 8px 16px;\n border-radius: 8px;\n cursor: pointer;\n font-size: 0.875rem;\n font-weight: 600;\n transition: all 0.2s;\n }\n\n #pea-pro-container .pea-theme-toggle:hover {\n border-color: var(--pea-card-border-hover);\n background: var(--pea-card-border);\n }\n\n \/* Input \/ Sample Section *\/\n #pea-pro-container .pea-input-section {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n border-radius: var(--pea-radius);\n padding: 24px;\n margin-bottom: 24px;\n box-shadow: var(--pea-shadow);\n }\n\n #pea-pro-container .pea-section-title {\n font-size: 1.1rem;\n font-weight: 700;\n margin-bottom: 12px;\n display: flex;\n justify-content: space-between;\n align-items: center;\n flex-wrap: wrap;\n gap: 12px;\n }\n\n #pea-pro-container textarea {\n width: 100%;\n height: 180px;\n background: var(--pea-bg);\n border: 1px solid var(--pea-card-border);\n color: var(--pea-text);\n padding: 14px;\n border-radius: 8px;\n font-family: monospace;\n font-size: 0.85rem;\n resize: vertical;\n outline: none;\n transition: border-color 0.2s;\n }\n\n #pea-pro-container textarea:focus {\n border-color: var(--pea-primary);\n }\n\n #pea-pro-container .pea-btn-group {\n display: flex;\n gap: 12px;\n margin-top: 16px;\n flex-wrap: wrap;\n justify-content: space-between;\n align-items: center;\n }\n\n #pea-pro-container .pea-btn {\n background: var(--pea-primary);\n color: white;\n border: none;\n padding: 10px 20px;\n border-radius: 8px;\n font-weight: 600;\n cursor: pointer;\n transition: background 0.2s, transform 0.1s;\n font-size: 0.875rem;\n display: inline-flex;\n align-items: center;\n gap: 8px;\n box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.1);\n }\n\n #pea-pro-container .pea-btn:hover {\n background: var(--pea-primary-hover);\n }\n\n #pea-pro-container .pea-btn:active {\n transform: scale(0.98);\n }\n\n #pea-pro-container .pea-btn-secondary {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n color: var(--pea-text);\n box-shadow: none;\n }\n\n #pea-pro-container .pea-btn-secondary:hover {\n background: var(--pea-card-border);\n border-color: var(--pea-card-border-hover);\n }\n\n #pea-pro-container .pea-samples-dropdown {\n display: flex;\n gap: 8px;\n align-items: center;\n }\n\n #pea-pro-container select {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n color: var(--pea-text);\n padding: 8px 14px;\n border-radius: 8px;\n cursor: pointer;\n font-size: 0.875rem;\n outline: none;\n }\n\n #pea-pro-container select:focus {\n border-color: var(--pea-primary);\n }\n\n \/* Dashboard Overview Grid *\/\n #pea-pro-container .pea-dashboard {\n display: grid;\n grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));\n gap: 16px;\n margin-bottom: 24px;\n }\n\n #pea-pro-container .pea-card {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n border-radius: var(--pea-radius);\n padding: 20px;\n box-shadow: var(--pea-shadow);\n }\n\n #pea-pro-container .pea-card-title {\n font-size: 0.813rem;\n color: var(--pea-text-muted);\n margin-bottom: 8px;\n text-transform: uppercase;\n letter-spacing: 0.05em;\n font-weight: 700;\n }\n\n #pea-pro-container .pea-card-value {\n font-size: 1.5rem;\n font-weight: 800;\n }\n\n \/* Analysis Sections \/ Tabs *\/\n #pea-pro-container .pea-tabs {\n display: flex;\n gap: 8px;\n margin-bottom: 16px;\n border-bottom: 1px solid var(--pea-card-border);\n padding-bottom: 12px;\n flex-wrap: wrap;\n }\n\n #pea-pro-container .pea-tab-btn {\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n color: var(--pea-text-muted);\n padding: 8px 16px;\n border-radius: 8px;\n font-weight: 600;\n cursor: pointer;\n font-size: 0.875rem;\n transition: all 0.2s;\n }\n\n #pea-pro-container .pea-tab-btn.active {\n background: var(--pea-primary);\n color: white;\n border-color: var(--pea-primary);\n }\n\n #pea-pro-container .pea-tab-content {\n display: none;\n background: var(--pea-card-bg);\n border: 1px solid var(--pea-card-border);\n border-radius: var(--pea-radius);\n padding: 24px;\n margin-bottom: 24px;\n box-shadow: var(--pea-shadow);\n }\n\n #pea-pro-container .pea-tab-content.active {\n display: block;\n }\n\n \/* Indicators Table & Lists *\/\n #pea-pro-container .pea-table-container {\n overflow-x: auto;\n margin-top: 12px;\n }\n\n #pea-pro-container table {\n width: 100%;\n border-collapse: collapse;\n text-align: left;\n font-size: 0.875rem;\n white-space: nowrap;\n }\n\n #pea-pro-container th, #pea-pro-container td {\n padding: 12px 16px;\n border-bottom: 1px solid var(--pea-card-border);\n }\n\n #pea-pro-container th {\n background: rgba(0, 0, 0, 0.15);\n font-weight: 700;\n color: var(--pea-text-muted);\n }\n\n #pea-pro-container tr:last-child td {\n border-bottom: none;\n }\n\n #pea-pro-container .pea-badge {\n display: inline-flex;\n align-items: center;\n gap: 6px;\n padding: 4px 10px;\n border-radius: 6px;\n font-size: 0.75rem;\n font-weight: 700;\n }\n\n #pea-pro-container .pea-badge-safe {\n background: rgba(16, 185, 129, 0.15);\n color: var(--pea-accent);\n }\n\n #pea-pro-container .pea-badge-low {\n background: rgba(59, 130, 246, 0.15);\n color: var(--pea-primary);\n }\n\n #pea-pro-container .pea-badge-warning {\n background: rgba(245, 158, 11, 0.15);\n color: var(--pea-warning);\n }\n\n #pea-pro-container .pea-badge-danger {\n background: rgba(239, 68, 68, 0.15);\n color: var(--pea-danger);\n }\n\n #pea-pro-container .pea-badge-critical {\n background: rgba(185, 28, 28, 0.25);\n color: #f87171;\n }\n\n \/* Educational Breakdown Cards *\/\n #pea-pro-container .pea-edu-grid {\n display: grid;\n grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));\n gap: 16px;\n margin-top: 16px;\n }\n\n #pea-pro-container .pea-edu-card {\n background: var(--pea-bg);\n border: 1px solid var(--pea-card-border);\n border-radius: 10px;\n padding: 16px;\n }\n\n #pea-pro-container .pea-edu-card h4 {\n margin-top: 0;\n margin-bottom: 8px;\n font-size: 1rem;\n color: var(--pea-primary);\n }\n\n #pea-pro-container .pea-edu-card p {\n margin: 0;\n font-size: 0.85rem;\n color: var(--pea-text-muted);\n line-height: 1.5;\n }\n\n #pea-pro-container .pea-hidden {\n display: none !important;\n }\n\n @media (max-width: 768px) {\n #pea-pro-container {\n padding: 12px;\n }\n #pea-pro-container header {\n flex-direction: column;\n align-items: stretch;\n }\n #pea-pro-container .pea-header-actions {\n justify-content: space-between;\n }\n #pea-pro-container .pea-btn-group {\n flex-direction: column;\n align-items: stretch;\n }\n }\n <\/style>\n<\/head>\n<body>\n\n <div id=\"pea-pro-container\">\n <header>\n <h1>\ud83c\udfa3 Phishing Email Analyzer Pro <span style=\"font-size: 0.85rem; background: rgba(99, 102, 241, 0.15); color: var(--pea-primary); padding: 4px 10px; border-radius: 6px; font-weight: 600;\">Education Edition<\/span><\/h1>\n <div class=\"pea-header-actions\">\n <button type=\"button\" class=\"pea-theme-toggle\" id=\"pea-theme-toggle\">\ud83c\udf13 Theme<\/button>\n <\/div>\n <\/header>\n\n \n <div class=\"pea-input-section\">\n <div class=\"pea-section-title\">\n <span>Paste Raw Email Source \/ Headers & Body<\/span>\n <div class=\"pea-samples-dropdown\">\n <select id=\"pea-sample-select\" title=\"Load Educational Sample\">\n <option value=\"\">— Load Sample Phish —<\/option>\n <option value=\"bank\">Sample 1: Fake Bank Urgent Password Reset<\/option>\n <option value=\"hr\">Sample 2: HR Payroll Update Scam<\/option>\n <option value=\"it\">Sample 3: IT Support Microsoft 365 Expiry<\/option>\n <\/select>\n <\/div>\n <\/div>\n <textarea id=\"pea-email-input\" placeholder=\"Paste full email raw text, headers (Return-Path, Received, Authentication-Results), and body here...\"><\/textarea>\n <div class=\"pea-btn-group\">\n <button type=\"button\" class=\"pea-btn\" id=\"pea-analyze-btn\">\ud83d\udd0d Run Phishing Analysis<\/button>\n <button type=\"button\" class=\"pea-btn pea-btn-secondary\" id=\"pea-clear-btn\">\ud83d\uddd1\ufe0f Clear<\/button>\n <\/div>\n <\/div>\n\n \n <div class=\"pea-dashboard pea-hidden\" id=\"pea-dashboard\">\n <div class=\"pea-card\">\n <div class=\"pea-card-title\">Threat Verdict<\/div>\n <div class=\"pea-card-value\" id=\"pea-stat-verdict\">–<\/div>\n <\/div>\n <div class=\"pea-card\">\n <div class=\"pea-card-title\">Risk Score<\/div>\n <div class=\"pea-card-value\" id=\"pea-stat-score\">0 \/ 100<\/div>\n <\/div>\n <div class=\"pea-card\">\n <div class=\"pea-card-title\">Suspicious URLs<\/div>\n <div class=\"pea-card-value\" id=\"pea-stat-urls\">0<\/div>\n <\/div>\n <div class=\"pea-card\">\n <div class=\"pea-card-title\">Anomalies Detected<\/div>\n <div class=\"pea-card-value\" id=\"pea-stat-anomalies\">0<\/div>\n <\/div>\n <\/div>\n\n \n <div id=\"pea-results-container\" class=\"pea-hidden\">\n <div class=\"pea-tabs\">\n <button type=\"button\" class=\"pea-tab-btn active\" data-tab=\"overview\">\ud83d\udcca Summary & Verdict<\/button>\n <button type=\"button\" class=\"pea-tab-btn\" data-tab=\"headers\">\ud83d\udcec Header Breakdown<\/button>\n <button type=\"button\" class=\"pea-tab-btn\" data-tab=\"urls\">\ud83d\udd17 Extracted URLs & Domains<\/button>\n <button type=\"button\" class=\"pea-tab-btn\" data-tab=\"indicators\">\ud83d\udea9 Threat Indicators<\/button>\n <button type=\"button\" class=\"pea-tab-btn\" data-tab=\"education\">\ud83c\udf93 Analyst Training Guide<\/button>\n <\/div>\n\n \n <div class=\"pea-tab-content active\" id=\"tab-overview\">\n <h3 style=\"margin-top:0;\">Investigation Summary<\/h3>\n <p id=\"pea-summary-text\" style=\"color: var(--pea-text-muted); line-height: 1.6;\"><\/p>\n <div style=\"margin-top: 20px;\">\n <h4 style=\"margin-bottom: 8px;\">Key Findings:<\/h4>\n <ul id=\"pea-findings-list\" style=\"margin: 0; padding-left: 20px; color: var(--pea-text-muted); line-height: 1.6;\"><\/ul>\n <\/div>\n <\/div>\n\n \n <div class=\"pea-tab-content\" id=\"tab-headers\">\n <h3 style=\"margin-top:0;\">Parsed Email Headers<\/h3>\n <div class=\"pea-table-container\">\n <table>\n <thead>\n <tr>\n <th>Header Field<\/th>\n <th>Extracted Value<\/th>\n <th>Security Implication<\/th>\n <\/tr>\n <\/thead>\n <tbody id=\"pea-headers-tbody\"><\/tbody>\n <\/table>\n <\/div>\n <\/div>\n\n \n <div class=\"pea-tab-content\" id=\"tab-urls\">\n <h3 style=\"margin-top:0;\">Discovered URLs & Links<\/h3>\n <p style=\"color: var(--pea-text-muted); font-size: 0.875rem;\">Links are automatically defanged (e.g., <code style=\"color:var(--pea-primary);\">http[s]:\/\/<\/code> and <code style=\"color:var(--pea-primary);\">[.]<\/code>) for safe educational handling.<\/p>\n <div class=\"pea-table-container\">\n <table>\n <thead>\n <tr>\n <th>Defanged URL<\/th>\n <th>Domain<\/th>\n <th>Risk Assessment<\/th>\n <\/tr>\n <\/thead>\n <tbody id=\"pea-urls-tbody\"><\/tbody>\n <\/table>\n <\/div>\n <\/div>\n\n \n <div class=\"pea-tab-content\" id=\"tab-indicators\">\n <h3 style=\"margin-top:0;\">Detected Threat Indicators (IOCs)<\/h3>\n <div class=\"pea-table-container\">\n <table>\n <thead>\n <tr>\n <th>Indicator Type<\/th>\n <th>Value<\/th>\n <th>Severity<\/th>\n <\/tr>\n <\/thead>\n <tbody id=\"pea-indicators-tbody\"><\/tbody>\n <\/table>\n <\/div>\n <\/div>\n\n \n <div class=\"pea-tab-content\" id=\"tab-education\">\n <h3 style=\"margin-top:0;\">Analyst Training & Educational Breakdown<\/h3>\n <p style=\"color: var(--pea-text-muted);\">Learn how security analysts dissect phishing emails manually and what techniques attackers use to deceive victims.<\/p>\n <div class=\"pea-edu-grid\">\n <div class=\"pea-edu-card\">\n <h4>1. Spoofed Sender Addresses<\/h4>\n <p>Attackers often display a trusted name in the <code style=\"color:var(--pea-primary);\">From<\/code> header while the actual underlying <code style=\"color:var(--pea-primary);\">Return-Path<\/code> or <code style=\"color:var(--pea-primary);\">Reply-To<\/code> points to an unrelated public or attacker-controlled domain.<\/p>\n <\/div>\n <div class=\"pea-edu-card\">\n <h4>2. Deceptive Hyperlinks<\/h4>\n <p>Phishing links frequently display friendly anchor text or official-looking domains while directing the user to completely different attacker-controlled landing pages designed for credential harvesting.<\/p>\n <\/div>\n <div class=\"pea-edu-card\">\n <h4>3. Artificial Urgency & Fear<\/h4>\n <p>Social engineering tactics rely on manufactured emergencies\u2014such as immediate account suspension, security breaches, or payroll errors\u2014to pressure victims into acting without verifying authenticity.<\/p>\n <\/div>\n <div class=\"pea-edu-card\">\n <h4>4. Authentication Failures<\/h4>\n <p>Examining SPF, DKIM, and DMARC results in email headers reveals whether the sending server was authorized by the domain owner to dispatch mail on their behalf.<\/p>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n\n <script>\n (function() {\n 'use strict';\n\n document.addEventListener('DOMContentLoaded', function() {\n const container = document.getElementById('pea-pro-container');\n if (!container) return;\n\n const themeToggleBtn = document.getElementById('pea-theme-toggle');\n const sampleSelect = document.getElementById('pea-sample-select');\n const emailInput = document.getElementById('pea-email-input');\n const analyzeBtn = document.getElementById('pea-analyze-btn');\n const clearBtn = document.getElementById('pea-clear-btn');\n\n const dashboard = document.getElementById('pea-dashboard');\n const resultsContainer = document.getElementById('pea-results-container');\n\n const statVerdict = document.getElementById('pea-stat-verdict');\n const statScore = document.getElementById('pea-stat-score');\n const statUrls = document.getElementById('pea-stat-urls');\n const statAnomalies = document.getElementById('pea-stat-anomalies');\n\n const summaryText = document.getElementById('pea-summary-text');\n const findingsList = document.getElementById('pea-findings-list');\n const headersTbody = document.getElementById('pea-headers-tbody');\n const urlsTbody = document.getElementById('pea-urls-tbody');\n const indicatorsTbody = document.getElementById('pea-indicators-tbody');\n\n \/\/ Educational Samples Database\n const samples = {\n bank: `Received: from mail.secure-bank-support-login.com (192.0.2.45) by mx.targetcorp.com with SMTP id x987; Mon, 02 Aug 2026 10:14:22 -0400\nFrom: \"Secure Banking Alert\" <support@secure-bank-support-login.com>\nReturn-Path: <bounces@evil-phishing-host.ru>\nReply-To: security@secure-bank-update-portal.net\nTo: employee@targetcorp.com\nSubject: URGENT: Your Online Banking Account Has Been Suspended!\nAuthentication-Results: spf=fail (sender IP is 192.0.2.45) dkim=none dmarc=fail\n\nDear Customer,\n\nWe detected unauthorized login attempts on your account. To prevent permanent closure, you must verify your identity immediately within 24 hours.\n\nPlease click the secure link below to restore access:\nhttps:\/\/secure-banking-login.com\/auth\/verify?id=99281\n\nSincerely,\nFraud Prevention Team`,\n hr: `Received: from mail.hr-payroll-update-portal.org (203.0.113.88) by mx.targetcorp.com with SMTP id h102; Mon, 02 Aug 2026 11:30:00 -0400\nFrom: \"HR Payroll Department\" <hr@hr-payroll-update-portal.org>\nReturn-Path: <admin@hr-payroll-update-portal.org>\nReply-To: hr-secure@free-mail-provider.com\nTo: employee@targetcorp.com\nSubject: ACTION REQUIRED: Updated Direct Deposit & Tax Forms for 2026\nAuthentication-Results: spf=pass dkim=neutral dmarc=neutral\n\nHello Staff,\n\nPlease review the attached updated tax withholding forms and confirm your direct deposit details before the upcoming payroll cutoff. \n\nAccess the portal here: http:\/\/payroll-update-portal-login.net\/signin?token=xyz123\n\nThank you,\nHuman Resources`,\n it: `Received: from mail.microsoft365-security-alerts.net (198.51.100.14) by mx.targetcorp.com with SMTP id i554; Mon, 02 Aug 2026 12:45:10 -0400\nFrom: \"Microsoft 365 Admin\" <admin@microsoft365-security-alerts.net>\nReturn-Path: <notification@microsoft365-security-alerts.net>\nReply-To: admin@microsoft365-security-alerts.net\nTo: employee@targetcorp.com\nSubject: Security Notice: Your M365 Password Expires Today\nAuthentication-Results: spf=fail dkim=fail dmarc=fail\n\nDear User,\n\nYour corporate mailbox password is set to expire in 2 hours. Failure to retain your current password will result in service termination.\n\nVerify your credentials at: https:\/\/login.microsoftonline.com.secure-update-portal.xyz\/auth\n\nRegards,\nIT Security Desk`\n };\n\n \/\/ Theme Toggle\n themeToggleBtn.addEventListener('click', function() {\n container.classList.toggle('pea-light-mode');\n });\n\n \/\/ Load Sample\n sampleSelect.addEventListener('change', function() {\n const val = this.value;\n if (samples[val]) {\n emailInput.value = samples[val];\n } else {\n emailInput.value = '';\n }\n });\n\n \/\/ Clear\n clearBtn.addEventListener('click', function() {\n emailInput.value = '';\n sampleSelect.value = '';\n dashboard.classList.add('pea-hidden');\n resultsContainer.classList.add('pea-hidden');\n });\n\n \/\/ Tabs Navigation\n const tabBtns = container.querySelectorAll('.pea-tab-btn');\n tabBtns.forEach(btn => {\n btn.addEventListener('click', function() {\n tabBtns.forEach(b => b.classList.remove('active'));\n container.querySelectorAll('.pea-tab-content').forEach(c => c.classList.remove('active'));\n \n this.classList.add('active');\n const targetId = 'tab-' + this.getAttribute('data-tab');\n const targetContent = document.getElementById(targetId);\n if (targetContent) {\n targetContent.classList.add('active');\n }\n });\n });\n\n \/\/ Robust Analysis Logic\n analyzeBtn.addEventListener('click', function() {\n const rawText = emailInput.value.trim();\n if (!rawText) {\n alert('Please paste email raw text or load a sample first.');\n return;\n }\n\n \/\/ Extract headers safely with robust fallbacks\n const fromMatch = rawText.match(\/^From:\\s*(.*)$\/im);\n const returnPathMatch = rawText.match(\/^Return-Path:\\s*(.*)$\/im);\n const replyToMatch = rawText.match(\/^Reply-To:\\s*(.*)$\/im);\n const subjectMatch = rawText.match(\/^Subject:\\s*(.*)$\/im);\n const authMatch = rawText.match(\/^Authentication-Results:\\s*(.*)$\/im);\n const receivedMatch = rawText.match(\/^Received:\\s*(.*)$\/im);\n\n const fromHeader = fromMatch && fromMatch[1] ? fromMatch[1].trim() : 'Not Found';\n const returnPath = returnPathMatch && returnPathMatch[1] ? returnPathMatch[1].trim() : 'Not Found';\n const replyTo = replyToMatch && replyToMatch[1] ? replyToMatch[1].trim() : 'None';\n const subject = subjectMatch && subjectMatch[1] ? subjectMatch[1].trim() : 'No Subject';\n const authResults = authMatch && authMatch[1] ? authMatch[1].trim() : 'Not Specified';\n const receivedHeader = receivedMatch && receivedMatch[1] ? receivedMatch[1].trim() : 'Unknown';\n\n \/\/ Extract URLs\n const urlRegex = \/https?:\\\/\\\/[^\\s]+\/g;\n const rawUrls = rawText.match(urlRegex) || [];\n const uniqueUrls = [...new Set(rawUrls)];\n\n \/\/ Heuristic Evaluation & Risk Scoring\n let riskScore = 10;\n let anomalies = [];\n let findings = [];\n\n \/\/ Authentication Checks\n const lowerAuth = authResults.toLowerCase();\n if (lowerAuth.includes('fail') || lowerAuth.includes('none')) {\n riskScore += 30;\n anomalies.push('Email authentication (SPF\/DKIM\/DMARC) failure or absence detected.');\n findings.push('Sender domain failed cryptographic verification checks (SPF\/DKIM\/DMARC).');\n } else if (lowerAuth.includes('pass')) {\n riskScore -= 5;\n }\n\n \/\/ Domain Mismatch Check\n const extractDomain = str => {\n const m = str.match(\/@([a-zA-Z0-9.-]+)\/);\n return m ? m[1].toLowerCase() : '';\n };\n const fromDom = extractDomain(fromHeader);\n const returnDom = extractDomain(returnPath);\n if (fromDom && returnDom && fromDom !== returnDom) {\n riskScore += 25;\n anomalies.push('Domain mismatch between From address and Return-Path.');\n findings.push(`From domain (${escapeHtml(fromDom)}) differs from Return-Path domain (${escapeHtml(returnDom)}), indicating potential spoofing.`);\n }\n\n \/\/ Reply-To Anomaly\n if (replyTo !== 'None' && !replyTo.toLowerCase().includes(fromDom)) {\n riskScore += 15;\n anomalies.push('Distinct Reply-To address detected pointing to an external domain.');\n findings.push(`Replies are redirected to a separate address: ${escapeHtml(replyTo)}`);\n }\n\n \/\/ Keyword Heuristics\n const lowerText = rawText.toLowerCase();\n const phishingKeywords = ['urgent', 'suspended', 'verify', 'password', 'expire', 'payroll', 'login', 'immediate', 'action required'];\n let keywordHits = phishingKeywords.filter(kw => lowerText.includes(kw));\n if (keywordHits.length >= 2) {\n riskScore += 20;\n anomalies.push(`High urgency social engineering trigger words detected (${keywordHits.join(', ')}).`);\n findings.push('Message uses coercive or urgent language to pressure recipients into immediate action.');\n }\n\n \/\/ Clamp risk score between 0 and 100\n if (riskScore < 0) riskScore = 0;\n if (riskScore > 100) riskScore = 100;\n\n \/\/ Threat Verdict Mapping\n let verdict = 'Safe';\n let verdictClass = 'pea-badge-safe';\n if (riskScore >= 20 && riskScore < 45) {\n verdict = 'Low Risk';\n verdictClass = 'pea-badge-low';\n } else if (riskScore >= 45 && riskScore < 75) {\n verdict = 'Medium Risk';\n verdictClass = 'pea-badge-warning';\n } else if (riskScore >= 75 && riskScore < 90) {\n verdict = 'High Risk';\n verdictClass = 'pea-badge-danger';\n } else if (riskScore >= 90) {\n verdict = 'Critical';\n verdictClass = 'pea-badge-critical';\n }\n\n \/\/ Populate Dashboard Metrics\n statVerdict.innerHTML = `<span class=\"pea-badge ${verdictClass}\">${verdict}<\/span>`;\n statScore.textContent = riskScore + ' \/ 100';\n statUrls.textContent = uniqueUrls.length;\n statAnomalies.textContent = anomalies.length;\n\n dashboard.classList.remove('pea-hidden');\n resultsContainer.classList.remove('pea-hidden');\n\n \/\/ Populate Overview Tab\n summaryText.textContent = `The analysis engine evaluated email headers, structural components, and textual heuristics. A calculated risk score of ${riskScore}\/100 was assigned, resulting in a verdict of ${verdict}. ${anomalies.length} security anomaly\/anomalies were successfully flagged.`;\n \n findingsList.innerHTML = '';\n if (findings.length === 0) {\n findingsList.innerHTML = '<li>No major anomalies detected. The message structure appears normal.<\/li>';\n } else {\n findings.forEach(f => {\n const li = document.createElement('li');\n li.textContent = f;\n findingsList.appendChild(li);\n });\n }\n\n \/\/ Populate Headers Table\n headersTbody.innerHTML = `\n <tr><td><strong>From<\/strong><\/td><td><code>${escapeHtml(fromHeader)}<\/code><\/td><td>Identifies the displayed sender persona.<\/td><\/tr>\n <tr><td><strong>Return-Path<\/strong><\/td><td><code>${escapeHtml(returnPath)}<\/code><\/td><td>Destination address for bounces and mail delivery reports.<\/td><\/tr>\n <tr><td><strong>Reply-To<\/strong><\/td><td><code>${escapeHtml(replyTo)}<\/code><\/td><td>Designated recipient address when replying.<\/td><\/tr>\n <tr><td><strong>Subject<\/strong><\/td><td><code>${escapeHtml(subject)}<\/code><\/td><td>Email subject line text.<\/td><\/tr>\n <tr><td><strong>Authentication<\/strong><\/td><td><code>${escapeHtml(authResults)}<\/code><\/td><td>SPF\/DKIM\/DMARC server validation status.<\/td><\/tr>\n <tr><td><strong>Originating Hop<\/strong><\/td><td><code>${escapeHtml(receivedHeader.substring(0, 60))}...<\/code><\/td><td>Initial receiving mail server network trace.<\/td><\/tr>\n `;\n\n \/\/ Populate URLs Table\n urlsTbody.innerHTML = '';\n if (uniqueUrls.length === 0) {\n urlsTbody.innerHTML = '<tr><td colspan=\"3\" style=\"text-align:center; color:var(--pea-text-muted);\">No URLs found in the text.<\/td><\/tr>';\n } else {\n uniqueUrls.forEach(url => {\n const defanged = defangUrl(url);\n const domain = extractDomainFromUrl(url);\n const isSuspicious = url.includes('login') || url.includes('auth') || url.includes('verify') || url.includes('xyz') || url.includes('net') || url.includes('support');\n const badge = isSuspicious ? '<span class=\"pea-badge pea-badge-warning\">Suspicious Pattern<\/span>' : '<span class=\"pea-badge pea-badge-safe\">Standard Link<\/span>';\n \n urlsTbody.innerHTML += `\n <tr>\n <td><code style=\"font-size:0.75rem;\">${escapeHtml(defanged)}<\/code><\/td>\n <td><code>${escapeHtml(domain)}<\/code><\/td>\n <td>${badge}<\/td>\n <\/tr>\n `;\n });\n }\n\n \/\/ Populate Indicators Table\n indicatorsTbody.innerHTML = '';\n if (anomalies.length === 0) {\n indicatorsTbody.innerHTML = '<tr><td colspan=\"3\" style=\"text-align:center; color:var(--pea-text-muted);\">No threat indicators triggered.<\/td><\/tr>';\n } else {\n anomalies.forEach(ano => {\n indicatorsTbody.innerHTML += `\n <tr>\n <td><span class=\"pea-badge pea-badge-warning\">Anomaly<\/span><\/td>\n <td>${escapeHtml(ano)}<\/td>\n <td><span class=\"pea-badge pea-badge-danger\">High Severity<\/span><\/td>\n <\/tr>\n `;\n });\n }\n });\n\n \/\/ Helper Functions\n function defangUrl(url) {\n return url\n .replace(\/https?:\\\/\\\/\/g, 'hxxps:\/\/')\n .replace(\/\\.\/g, '[.]');\n }\n\n function extractDomainFromUrl(url) {\n try {\n const parsed = new URL(url);\n return parsed.hostname;\n } catch (e) {\n return 'Invalid URL';\n }\n }\n\n function escapeHtml(str) {\n return String(str)\n .replace(\/&\/g, \"&\")\n .replace(\/<\/g, \"<\")\n .replace(\/>\/g, \">\")\n .replace(\/\"\/g, \""\")\n .replace(\/'\/g, \"'\");\n }\n });\n })();\n <\/script>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>Phishing Email Analyzer Pro – Education Edition \ud83c\udfa3 Phishing Email Analyzer Pro Education Edition \ud83c\udf13 Theme Paste Raw Email Source \/ Headers & Body — Load Sample Phish —Sample 1: Fake Bank Urgent Password ResetSample 2: HR Payroll Update ScamSample 3: IT Support Microsoft 365 Expiry \ud83d\udd0d Run Phishing Analysis \ud83d\uddd1\ufe0f Clear Threat Verdict – […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-871","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/pages\/871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/comments?post=871"}],"version-history":[{"count":2,"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/pages\/871\/revisions"}],"predecessor-version":[{"id":873,"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/pages\/871\/revisions\/873"}],"wp:attachment":[{"href":"https:\/\/freewebtools.co.in\/index.php\/wp-json\/wp\/v2\/media?parent=871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}